I created a simple rule just for testing purposes.
alert icmp $HOME_NET any → 22.214.171.124 any (msg:“VOILA TESTE”; sid:5000000;)
Let´s assume that i restart Suricata. If i ping that address, Suricata gives the alert just fine. But, after some minutes, if i ping the address again and again i get no alerts on Suricata.
Why does this happen?
Can you tell us more about your config, how you run Suricata etc.?
I am running Suricata on AF_PACKET on 3 interfaces that receive mirrored traffic. Maybe it has something to do with the flow-timeouts?
checksum-validation: yes # reject incorrect csums
inline: no # auto will use inline mode in IPS mode, yes or no set it statically
depth: 12mb # reassemble 1mb into a stream
Same on the 3 interfaces:
- interface: enp3s0f0
Probably the second attempt is getting into the flow-timeout period (established flow).
Try to decrease the value in the icmp field.
Thank you. It was the solution!
Another thing that i noticed is that the alert is logged almost instantly but the other events (e.g. netflow, tls, http logs) are only shown after ~6min after the alert is logged.
Is this normal behaviour?
It is normal for the netflow for sure since it summarizes multiple transactions into one event and will output the log after a timeout